{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50647", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-08T23:57:43.371Z", "datePublished": "2025-12-09T00:00:21.501Z", "dateUpdated": "2026-05-11T19:22:53.598Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T19:22:53.598Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: Make port I/O string accessors actually work\n\nFix port I/O string accessors such as `insb', `outsb', etc. which use\nthe physical PCI port I/O address rather than the corresponding memory\nmapping to get at the requested location, which in turn breaks at least\naccesses made by our parport driver to a PCIe parallel port such as:\n\nPCI parallel port detected: 1415:c118, I/O at 0x1000(0x1008), IRQ 20\nparport0: PC-style at 0x1000 (0x1008), irq 20, using FIFO [PCSPP,TRISTATE,COMPAT,EPP,ECP]\n\ncausing a memory access fault:\n\nUnable to handle kernel access to user memory without uaccess routines at virtual address 0000000000001008\nOops [#1]\nModules linked in:\nCPU: 1 PID: 350 Comm: cat Not tainted 6.0.0-rc2-00283-g10d4879f9ef0-dirty #23\nHardware name: SiFive HiFive Unmatched A00 (DT)\nepc : parport_pc_fifo_write_block_pio+0x266/0x416\n ra : parport_pc_fifo_write_block_pio+0xb4/0x416\nepc : ffffffff80542c3e ra : ffffffff80542a8c sp : ffffffd88899fc60\n gp : ffffffff80fa2700 tp : ffffffd882b1e900 t0 : ffffffd883d0b000\n t1 : ffffffffff000002 t2 : 4646393043330a38 s0 : ffffffd88899fcf0\n s1 : 0000000000001000 a0 : 0000000000000010 a1 : 0000000000000000\n a2 : ffffffd883d0a010 a3 : 0000000000000023 a4 : 00000000ffff8fbb\n a5 : ffffffd883d0a001 a6 : 0000000100000000 a7 : ffffffc800000000\n s2 : ffffffffff000002 s3 : ffffffff80d28880 s4 : ffffffff80fa1f50\n s5 : 0000000000001008 s6 : 0000000000000008 s7 : ffffffd883d0a000\n s8 : 0004000000000000 s9 : ffffffff80dc1d80 s10: ffffffd8807e4000\n s11: 0000000000000000 t3 : 00000000000000ff t4 : 393044410a303930\n t5 : 0000000000001000 t6 : 0000000000040000\nstatus: 0000000200000120 badaddr: 0000000000001008 cause: 000000000000000f\n[] parport_pc_compat_write_block_pio+0xfe/0x200\n[] parport_write+0x46/0xf8\n[] lp_write+0x158/0x2d2\n[] vfs_write+0x8e/0x2c2\n[] ksys_write+0x52/0xc2\n[] sys_write+0xe/0x16\n[] ret_from_syscall+0x0/0x2\n---[ end trace 0000000000000000 ]---\n\nFor simplicity address the problem by adding PCI_IOBASE to the physical\naddress requested in the respective wrapper macros only, observing that\nthe raw accessors such as `__insb', `__outsb', etc. are not supposed to\nbe used other than by said macros. Remove the cast to `long' that is no\nlonger needed on `addr' now that it is used as an offset from PCI_IOBASE\nand add parentheses around `addr' needed for predictable evaluation in\nmacro expansion. No need to make said adjustments in separate changes\ngiven that current code is gravely broken and does not ever work." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/riscv/include/asm/io.h" ], "versions": [ { "version": "fab957c11efe2f405e08b9f0d080524bc2631428", "lessThan": "2c60db6869fe5213471fcf4fe5704dc29da8b5ee", "status": "affected", "versionType": "git" }, { "version": "fab957c11efe2f405e08b9f0d080524bc2631428", "lessThan": "2ce9fab94b8db61f014e43ddf80dd1524ae6dff4", "status": "affected", "versionType": "git" }, { "version": "fab957c11efe2f405e08b9f0d080524bc2631428", "lessThan": "dc235db7b79a352d07d62e8757ad856dbf1564c1", "status": "affected", "versionType": "git" }, { "version": "fab957c11efe2f405e08b9f0d080524bc2631428", "lessThan": "140b2b92dbefffa7f4f7211a1fd399a6e79e71c4", "status": "affected", "versionType": "git" }, { "version": "fab957c11efe2f405e08b9f0d080524bc2631428", "lessThan": "1acee4616930fc07265cb8e539753a8062daa8e0", "status": "affected", "versionType": "git" }, { "version": "fab957c11efe2f405e08b9f0d080524bc2631428", "lessThan": "9cc205e3c17d5716da7ebb7fa0c985555e95d009", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/riscv/include/asm/io.h" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.220", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.150", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.75", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.17", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.3", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.4.220" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.150" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.19.17" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.0.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2c60db6869fe5213471fcf4fe5704dc29da8b5ee" }, { "url": "https://git.kernel.org/stable/c/2ce9fab94b8db61f014e43ddf80dd1524ae6dff4" }, { "url": "https://git.kernel.org/stable/c/dc235db7b79a352d07d62e8757ad856dbf1564c1" }, { "url": "https://git.kernel.org/stable/c/140b2b92dbefffa7f4f7211a1fd399a6e79e71c4" }, { "url": "https://git.kernel.org/stable/c/1acee4616930fc07265cb8e539753a8062daa8e0" }, { "url": "https://git.kernel.org/stable/c/9cc205e3c17d5716da7ebb7fa0c985555e95d009" } ], "title": "RISC-V: Make port I/O string accessors actually work", "x_generator": { "engine": "bippy-1.2.0" } } } }